Re: [VulnDiscuss] Main thread's exception handler

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This method would require you to have a pointer to your shellcode on
the main thread's stack, and be able to force an exception in the main
thread, if you can only do one reliable write, correct?

- -dave

Halvar Flake wrote:

| Hey all,
|
| I have not read the exploit either, but the first threads TEB
| address is static, and if you happen to know what you´re doing you
| can use this to hijack the top-level pointer to the SEH chain (fs:0
| of the first thread is aliased to 0x7FFDE000 if I recall correctly)
| reliably -- this is superior to using the UnhandledExceptionFilter
| ptr. The technique is not much fun unless you can do multiple
| (read: as many as you wish) writes, and I would assume it is far
| inferior to other published approaches. It is quite aged as well
| ("vintage exploits" ;), dating to some time around 2001/2002 IIRC.
|
| If you get a decent number of writes, it can be quite useful tho.
| Does anyone know more about Windows randomizing TEB/PEB addresses
| in XPSP2 ?
|
| Cheers, Halvar
|

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFAqplhzOrqAtg8JS8RAtQgAJ95lZDGA+bNd22eTaTkTRIcRVxhrACgwL/f
2z2JGcubZzW0ZthlgIQ9p3k=
=BzB4
-----END PGP SIGNATURE-----